GNU cpio -O archive option insecure permissions
| cpio-o-archive-insecure-permissions (19167) |  Medium Risk |
Description:
GNU cpio creates files with mode 0666 (world readable and writable) permissions when the -O archive option is used. A local attacker could use this vulnerability to view or overwrite arbitrary files on the system.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Conectiva, Linux 10
- Debian, Debian Linux 3.0
- FreeBSD, FreeBSD 2.1.0
- GNU, cpio
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Turbolinux, Turbolinux 10 Server
Remedy:
For FreeBSD:
Reportedly, this vulnerability is fixed in version 1.3 of cpio/main.c. Refer to the FreeBSD Web site for more information. See References.
For Ubuntu Linux:
Refer to USN-75-1 for patch, upgrade, or suggested workaround information. See References.
For Debian GNU/Linux 3.0(woody):
Upgrade to the latest version of cpio (2.4.2-39woody1 or later), as listed in DSA-664-1. See References.
For Conectiva Linux 10.0:
Upgrade to the latest version of cpio, as listed in Conectiva Linux Security Announcement CLSA-2005:1002. See References.
For Red Hat Linux:
Refer to RHSA-2005:073-07, RHSA-2005:080-06, RHSA-2005:806-8 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
File Manipulation
References:
- Conectiva Linux Security Announcement CLSA-2005:1002, Fixes for cpio vulnerabilities at http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=001002.
- Cpio Web page, Cpio at http://www.gnu.org/software/cpio/.
- FreeBSD Web site, cpio -O ignores umask at http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/1391.
- BID-12404: CPIO Archiver Local Insecure File Creation Vulnerability
- CVE-1999-1572: cpio on FreeBSD 2.1.0, Debian GNU/Linux 3.0, and possibly other operating systems, uses a 0 umask when creating files using the -O (archive) or -F options, which creates the files with mode 0666 and allows local users to read or overwrite those files.
- DSA-664: cpio -- broken file permissions
- MDKSA-2005:032: Updated cpio packages fix vulnerability
- MDKSA-2005:032-1: Updated cpio packages fix vulnerability
- RHSA-2005-073: cpio security update
- RHSA-2005-080: cpio security update
- RHSA-2005-806: cpio security update
- SA17063: Avaya Products cpio Insecure File Creation Vulnerability
Reported:
Jul 16, 1996
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net